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Arguments for claim 31 



31. (Original) The software application of claim 30 wherein each checksum wtndow process 9 bytes of 
dataS-bytesatattoKeachtkre 

Oakft 30 (and others) which serve as the basis for claim 3 1 , were concaved and described by the applicant 
without awareness of thevwy similar Rahm-Karp algorithm. Now being aware Rabm-Kara Chum 31 
should be con$ideasl a* aiterjhaaGeraem to that 



Background and prior art: 

The invention in Claim 31 was motivated by a desire to find a faster way to scan a stream of data from a 
network looking for byte patterns that would indicate the presence of a computer vim a in the streanv 
Current Ami virus products traditionally use the Aho-Corasick pattern matching algorithm A good 
description of this is available on WOripedia: 

http://en.wikipedia,org/^^ 

The fat pattern algorithm design by applicant used a modified version of hashing to achieve a 
substantia) speed increase ewer AfcfrCorasfctt 

Wtkipema describes conventional hashing here: 

htrp'7/en.wikipedU.orgAviki/Hashir^ 

Note mat the Wild podia entries dte computer virus searches as aft application for Aho-Corasick, 
bur-net for hashing. Conventional hashing knot as fast for virus signature detection s^Aho^orasick, smce 
hashing * bytes usually require a operations. 

In researching this document applicant uncovered another related algorithm, theRabin-Karp 
search algorithm, described here: 

htr^://en.wikfpedla.org^^ 

BUbithKarp u&ea. the term "foiling hash" to describe what applicant referred to a& "sliding 
window". The existence ofRabin-Karp is "prior art", and as such indicates the original "Claim 15* (sliding 
window) is in feet not original. 



Merits of claim 31 



Claim 3 1 introduced the idea of dividing the "sliding window" (or "rolling hash") being searched 
into multiple byte chunks for the purpose of computing the hash value. Specifically, claim 31 cites the 
example of dividing a 9 byte window into three-byte chunks* This means the hash value can be computed 
with single addition and subtraction operations - very fast on modern c om p u te r CPUs such as Intel Pentium 
and "Risk" processors sudtas PowerPC. 

By contract, Rabin-Karp had only considered the more computationally expensive concept of 
treating the potion of the data stream that waste the "sliding window** (or "rolling hash'*) as a large based 
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number. Implementation* of RabithKarp thus involve multiplication operations, which are vmy CPU 
intensive. 

Thus the division of the data tit the sliding window allows a variation of the Rabin Karp algorithm 
whh a substantial speed improvement, and Claim 31 should be allowed. 



John Alexander Bartas 



Note new contract information: 

John Bartas 

10230 Lebanon Drive 

Cupertino CA MOW 

40*2574414 
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